A critical security vulnerability in Microsoft Outlook, identified as CVE-2024-21413, allows remote unauthenticated attackers to perform remote code execution (RCE) attacks by exploiting a flaw that also bypasses Office Protected View. This vulnerability, which affects various Microsoft Office products, can be exploited by simply opening or previewing malicious emails containing specially crafted links, without any need for user interaction. The exploit involves a technique dubbed “Moniker Link” by Check Point, leveraging the “file://” protocol and an exclamation mark in URLs to bypass Outlook’s security measures, leading to potential theft of NTLM credentials and arbitrary code execution. Despite initial claims of active exploitation, Microsoft later corrected this assertion. The issue, rooted in the MkParseDisplayName API and potentially impacting software beyond Outlook, underscores a long-standing vulnerability in the Windows/COM ecosystem. Microsoft and Check Point urge users to apply the provided patch promptly to mitigate risks associated with this significant security flaw.